Troubleshooting Amazon VPC site-to-site VPN connections

Condition

After creating a site-to-site VPN connection between your local network and Amazon VPC, BGP peering doesn't automatically form.

Sophos Firewall shows the following statuses:

• AWS VPC Tunnel status is active and connected.
• BGP summary shows neighbor status stuck in active.

AWS VPC console shows the following statuses:

• AWS site-to-site VPN status is down.
• AWS site-to-site VPN details show IPsec is up.

Cause

BGP CLI configuration includes no bgp default ipv4-unicast.

What to do

You must update the BGP configuration and make the new Amazon VPC BGP neighbors active. Do the following:

1. Sign in to the command line using SSH. You can also access it from admin > Console in the upper-right corner of the web admin console.
2. Go to 3. Route Configuration > 1. Configure Unicast Routing > 3. Configure BGP.
3. Enter the following commands:
   1. enable
   2. conf t

4. Replace <as-number> with the Sophos Firewall Local AS number and enter the command as follows:

   router bgp <as-number>
   

   Tip

   You can find the Sophos Firewall Local AS number under Routing > BGP > Global configuration.

5. Replace <ip-address> with the IP address of the AWS site-to-site VPN connection and enter the command as follows:

   neighbor <ip-address> activate
   

6. Enter write to save the configuration.

Here's an example: